Add support for the rest of archive.org's service APIs

[jbuckner]

IAKit covers a small slice of archive.org's API surface right now. The developers portal documents a lot more. This is a tracking issue for working through the rest of it.

Already here (read-only, no auth)

• Item Metadata read, /metadata/{id} (itemDetail)
• Advanced Search, /advancedsearch.php (search)
• Reviews, parsed off the metadata response (Review model)
• Download and item-image URL building (/download/..., /services/img/...)

Read APIs still to add (no auth, fit the current read-only design)

• Scrape API, /services/search/v1/scrape. Full result-set enumeration past the 10k search ceiling. Already tracked in Add Scrape API support for reading past the 10,000-result search ceiling #33.
• Changes API. Discover items that changed since a given token or date.
• Views Data Service. Per-item view and engagement stats.
• RESTful microservices. The grab-bag under /services/ (image variants, find-file, etc.).
• Simple Lists / Relationships API.
• OCR / hOCR text access.
• PDF analysis, generation, and compression endpoints.

Write APIs (need S3 keys, so a bigger lift)

These all depend on the auth layer in #36 (consume injected S3 keys, optional xauthn login helper), so they're a natural phase 2.

• IAS3 S3-like API. Upload and manage files (s3.us.archive.org).
• Item Metadata write. Patch item metadata.
• Tasks API. Submit and track derive and other background tasks.
• Reviews write. Submit a review (read side is Add Support for Reviews #8).

Not applicable to a Swift client

Here for completeness so we don't go looking for them: the ia command-line tool, the Python library, and the Bots/LLMs automated-access guidelines.

---

Suggested order: do the read APIs first since they drop into the existing unauthenticated design. Hold the write APIs until the auth layer (#36) lands.

[jbuckner]

Ticked the scrape box, that shipped in #34. Filed child issues for the next read APIs: Views Data Service (#56), Simple Lists (#57), Changes API (#58). Heads up that the Changes API needs S3 keys, so it belongs with the auth-dependent group and is blocked on #36. Will file child issues for the write APIs once #36 lands. OCR/hOCR, PDF, and the microservices grab-bag still need scoping.

[jbuckner]

Progress: Views Data Service (#73), Simple Lists (#76), and the Changes API (#75, stacked on the auth PR #74) are implemented and open. Once #74 merges I'll file child issues for the write APIs (IAS3 upload, metadata write, Tasks, reviews write). Still to scope: OCR/hOCR, PDF services, and the microservices grab-bag.